Pkcs11 soft ocsp tests

[krishnavema]

Add optional label parameter for pkcs11 support

[gemini-code-assist]

Code Review

This pull request addresses RHEL-5043 by improving OCSP timeout handling in p11_child. It introduces a default timeout for soft_ocsp requests to prevent indefinite blocking and adjusts the OCSP deadline calculation to use half of the total allocated timeout, providing a buffer for result processing. Additionally, a new suite of system tests has been added to verify smart card authentication behavior under various OCSP responder availability scenarios. I have no feedback to provide.

[alexey-tikhonov]

@krishnavema, @spoore1, what branches does this target?

[thalman]

The tests and change looks good, but the requirements should not point to private fork

[thalman]

This must be reverted before merging

[spoore1]

Main thing I think is to move the tests into the existing test_smartcard.py file and use it's helper functions. Besides that, mostly questions for clarification.

[spoore1]

Didn't you write an authentication util for su for this in another PR? I think that should be used here.

[krishnavema]

I guess there is no existing util , do you mean somewhere in specific ?

[spoore1]

I was talking about what you did in this other PR here:
https://github.com/SSSD/sssd-test-framework/pull/239/changes#diff-3399c4ca6a52ee78cd188bf544a4db3318c8e89d60f0476f0566097b58145b08

I think that should be used for this test too if it can be. Maybe we need to review that PR along with this one too?

[thalman]

Scott's questions made me go through the code once more and I think that this is bad approach. See my comment.

[spoore1]

Testing on Fedora 42 with a downgraded version of sssd does reproduce the issue but, I'm unable to reproduce it anywhere else at this time.

[root@client ~]# rpm -q sssd
sssd-2.10.2-3.fc42.x86_64

[root@client ~]# su - smartcarduser1 -c 'su - smartcarduser1 -c whoami'
su: warning: cannot change directory to /home/smartcarduser1: No such file or directory
Password: 

When I upgrade to the latest available in Fedora 42, I see it work:

[root@client ~]# rpm -q sssd
sssd-2.11.1-2.fc42.x86_64

[root@client ~]# su - smartcarduser1 -c 'su - smartcarduser1 -c whoami'
su: warning: cannot change directory to /home/smartcarduser1: No such file or directory
PIN for smartcarduser1: 
su: warning: cannot change directory to /home/smartcarduser1: No such file or directory
smartcarduser1

Testing with the version built from this PR is not working for me however:

[root@client ~]# rpm -q sssd
sssd-2.13.0-99.20260417165143281553.pr8557.161.g0b090a236.fc42.x86_64

[root@client ~]# su - smartcarduser1 -c 'su - smartcarduser1 -c whoami'
su: warning: cannot change directory to /home/smartcarduser1: No such file or directory
Password: 

FYI, to test with the version built here, I used:

dnf copr enable packit/SSSD-sssd-8557 fedora-42-x86_64

Also, I tested with the master branch from sssd-ci-containers to run the Fedora 42 containers.

[spoore1]

I'm seeing the tests pass in Fedora 42 now for this version of sssd from this PR:

sssd-2.14.0-99.20260512082613085134.pr8557.194.g273d94b8f.fc42.x86_64

Test results:

tests/test_smartcard.py::test_smartcard__soft_ocsp_with_unreachable_responder (ipa) PASSED
tests/test_smartcard.py::test_smartcard__soft_ocsp_with_reachable_responder (ipa) PASSED
tests/test_smartcard.py::test_smartcard__soft_ocsp_with_connection_refused (ipa) PASSED

[spoore1]

I have a few questions about some of the sssd.conf settings but, the biggest thing is that I think you can now move from using some of the helper functions to some of the other methods you created in other PRs. Let me know if you have a specific reason for keeping the helpers I point out.

[spoore1]

Is this option really needed? It's usually only necessary for LDAP/local user authentication where Kerberos isn't used. It can allow authentication in IPA/AD configurations when Kerberos isn't working or the domain controller seems to be offline. I believe this can mask some issues if something is wrong in test environments like IPA.

FYI, I tested with this option commented and the tests pass "most of the time". During one failure, I manually checked and smart card authentication was working so I believe it may have been a timing issue in my env.